Service provider based network threat prevention

Abstract

Systems and methods responsive to communicated network threats are disclosed. An example method includes assembling a collection of files, inserting a network traffic monitor that identifies a first domain responsible for communicating a known threat, searching for and classifying files not in the collection of files, and updating the collection of files when the classification indicates that the file not in the collection of files is a network threat. An embodiment of a system includes a network traffic monitor, a crawler, a data store, and an analyzer. The network traffic monitor identifies a first domain responsible for communicating a threat. The crawler traverses the first domain and additional domains linked via the first domain. In addition, the crawler identifies changed files. The data store holds a collection of files associated with known threats and files not associated with threats. The analyzer examines and classifies new files and changed files.

1. A method for identifying a network threat, comprising:
 assembling a set of names of files responsible for proliferating a network threat and a set of names of files previously identified as not responsible for proliferating a network threat; 
 inserting a network traffic monitor within a network service provider's infrastructure, the network traffic monitor configured to identify a first domain responsible for presently communicating at least one file from the set of names of files responsible for proliferating a network threat; 
 searching the first domain for files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; 
 analyzing the content of the files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; and 
 adding a file name to one of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat responsive to the step of analyzing. 
 
     
     
       2. The method of  claim 1 , further comprising:
 searching the first domain for links to a second domain other than the first domain; 
 searching the second domain for files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; 
 analyzing the content of the files from the second domain not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; 
 adding a file name to one of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat responsive to the step of analyzing the content of files from the second domain; and 
 updating a set of domain names that contain at least one file from the set of names of files responsible for proliferating a network threat. 
 
     
     
       3. The method of  claim 2 , wherein analyzing the content of files comprises assigning a tag selected from the group of known threat, unknown, and no threat in response to the collection of files. 
     
     
       4. The method of  claim 3 , further comprising:
 providing files with the unknown tag to an automated screen configured to determine if each respective file when executed produces a behavior indicative of a threat to network communications, a computing device coupled to the network and data exposed via the network. 
 
     
     
       5. The method of  claim 4 , further comprising:
 generating a removal routine responsive to a file that when executed produces a behavior indicative of a threat. 
 
     
     
       6. The method of  claim 1 , further comprising:
 forwarding files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat to a data store prior to analyzing the files. 
 
     
     
       7. The method of  claim 6 , wherein forwarding files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat to a data store comprises generating and associating a digest with each respective file. 
     
     
       8. The method of  claim 7 , wherein the digest is used to distinguish the contents of a select file from all other files including previous versions of the select file. 
     
     
       9. The method of  claim 1 , further comprising:
 deriving an original digest for each file associated with the first domain; and 
 periodically comparing the original digest for each file with a subsequently derived digest to identify when a file has been modified. 
 
     
     
       10. The method of  claim 9 , further comprising:
 analyzing a file that has been modified to determine if an original classification associated with the file should be changed. 
 
     
     
       11. The method of  claim 10 , wherein analyzing a file that has been modified comprises applying a screen configured to determine if the file, when executed, produces a behavior indicative of a threat. 
     
     
       12. The method of  claim 11 , further comprising:
 generating a removal routine responsive to a file that when executed produces a behavior indicative of a threat. 
 
     
     
       13. A system for identifying a network threat, comprising:
 a network traffic monitor that receives a copy of traffic that traverses a network service provider's infrastructure to identify a first domain responsible for communicating previously identified network threats; 
 a crawler coupled to the network traffic monitor that traverses the first domain by following links on pages presented by the first domain to identify a new file that is not a member of a set of previously identified files that proliferate threats and not a member of a set of previously identified files that do not proliferate threats; 
 a data store communicatively coupled to the network traffic monitor and the crawler, the data store configured to hold a collection of files comprising the set of previously identified files that proliferate threats and a set of previously identified files that do not proliferate known threats, the new file, and an identifier associated with each of the first domain and the second domain; and 
 an analyzer coupled to the data store that examines the execution behavior of the new file and in response thereto classifies and returns the new file to be stored in the data store with one of the set of files that do not proliferate threats or the set of files that proliferate threats. 
 
     
     
       14. The system of  claim 13 , wherein the network traffic monitor is coupled to a router under the control of an Internet service provider. 
     
     
       15. The system of  claim 13 , wherein the network traffic monitor forwards a uniform resource locator to the data store. 
     
     
       16. The system of  claim 13 , wherein the network traffic monitor forwards a digest responsive to a portion of the traffic to the data store. 
     
     
       17. The system of  claim 13 , wherein the crawler is configured to identify when the contents of a file on the first domain have changed. 
     
     
       18. The system of  claim 17 , wherein the crawler forwards a file identifier to the data store. 
     
     
       19. The system of  claim 13 , wherein the analyzer is configured to generate a communication responsive to the new file. 
     
     
       20. The system of  claim 13 , further comprising:
 a server coupled to the Internet and configured to receive information responsive to the new file.